Here is the short version from our service desk: update Google Chrome and Microsoft Edge today, then close the browser and open it again. The update fixes a flaw that attackers are already using, and it does not take effect until the browser restarts.
What to Do Right Now
- Check Chrome. Open the Chrome menu (the three dots), then choose Help, then About Google Chrome. The page checks for an update on its own.
- Look at the version number. You want 157.0.8103.50 or newer. When the Relaunch button appears, click it.
- Check Edge too. Open the Edge menu (the three dots), then choose Help and Feedback, then About Microsoft Edge. Let the page check for an update and click Restart when that button appears. Edge is built on the same engine as Chrome and gets the fix through its own update.
- Restart even if you are busy. Browsers download updates in the background, but the new version only takes effect after the browser is closed and reopened. If you leave your browser open for days at a time, you can be running the old version without knowing it.
- Repeat on every computer you work from, and check for updates in any other browser built on the same engine, such as Opera or Brave.
Google says the Chrome update is rolling out over the coming days and weeks. If Chrome does not offer it yet, check again tomorrow.
What Happened
Google released a Chrome update with nine security fixes. One of them, tracked as CVE-2026-125350, is rated High, and Google says it is aware that an exploit for it "exists in the wild." In plain terms, a working attack is already out there.
On November 10, 2026, CISA (the federal Cybersecurity and Infrastructure Security Agency) added the flaw to its Known Exploited Vulnerabilities catalog, the list of flaws attackers are actively using, and gave federal agencies until November 24 to fix it.
Why It Matters to a Small Business
The flaw is not in Chrome alone. It sits in Chromium, the open source engine underneath Chrome, Edge, Opera, Brave and other browsers. If your team uses any of them, this applies to you.
The attack works through a web page built for the purpose. Someone has to open that page, for example by clicking a link, and the page can then run the attacker's code inside the browser.
How Serious Is It
Serious enough to act on today, but worth describing honestly. The attacker's code runs inside the browser's sandbox, a locked area that keeps web pages away from the rest of the computer. On its own, this flaw is a foothold, not a full takeover. Attackers usually pair a flaw like this with something else to get further.
That is the reason to close this door quickly. The fix is a browser update, and the only step you have to remember is the restart.
How We Handle Alerts Like This
Every morning our team checks CISA's list of actively exploited vulnerabilities against the software running in the environments we manage. When something like this lands, we look at which computers are behind, work to get them updated, and reach out directly to any client who needs to do something.
One honest caveat: an update that has downloaded but is still waiting on a restart is not protecting you yet, so please do not leave that Relaunch button for later.
Not sure who is keeping the computers in your office up to date, or want a second set of eyes on your security? Give us a call, or request a free external security scan and we will walk you through what we find on a short call.
Bri leads service delivery at PC Techware: the service desk, technical team and the standards behind every client environment.
